IMPORTANT! Have you received an email to your forum username?

Hi folks,

We just wanted to update everyone about what has been going on for the past couple of weeks since this thread was originally posted. The technical team here has been working incredibly hard both investigating and making changes. Thank you to all the users above who’ve been helping and guiding others.

Was there a new breach?

- We had reported previously we were aware of a breach in November 2009 and had since worked very hard on further tightening the security since that point (including external consultants to assess and analyse risk and improve procedures). One key question was whether the email sent was part of that breach or a new one.


- So far, we still have no confirmed reports of any forumites that joined in 2010 getting the spam email. A number of people who said in the thread that they had received one found they were mistaken (either about join date or had not received the email discussed) when we looked into it


- The poll results suggested 9% of the recipients of the email joined in 2010. However none of these have been in contact with us so that we can verify it. This is just about within the margin of error one may expect when taking into account wrong clicks, people being mistaken and possible malicious votes.


- We have received copious amounts of emails from people who joined after Nov 2009 saying they didn’t get the email – far outweighing those who say they did. Also many members who'd changed their login email address since November 2009 report the spam/Trojan email went to their old email address not the changed ones.


- Coupled with our technical team’s review of the forum’s code, and possible security risks, all of this evidence points to no new breach since the one we are aware of in November 2009. However, we are still more than willing to look at any evidence to the contrary and would ask you please email it to [EMAIL="webmaster@moneysavingexpert.com"]webmaster@moneysavingexpert.com[/EMAIL].

What action has been taken?

- Even though it seems there has been no new breach – we have conducted a thorough review and security analysis AS IF there had been, both as a preventative measure and to try to predict any potential weaknesses or breaches for the future.


- The technical team have undertaken a thorough review of the forum’s underlying code, to find points which we could try and make even more secure. Obviously we won’t be detailing exact measures taken as this could be useful information for any malicious hackers roaming the web.


- The technical team have also taken steps to make it harder for large scale harvesting of email addresses, in the event that we were hacked in future.
- While we don’t believe any access to the password file has happened (and it would be very difficult to do), as a precaution for the future we have added an extra warning when users choose a password, advising never to choose something you use for other websites that store sensitive personal information about you.


- While we have no indication of any breach of Private Messages during our investigation, we noted that some people used PMs as if they were a secure form of communication. To prevent this extra warnings have been added whenever users compose a Private Message (PM), reminding them not to send sensitive personal details via PM.

What has been done about the senders of the trojan?

- We contacted the police computer crime unit about this and filed a statement.


- The spam emails sent out contained links, which we advised users not to click. After reporting this to the authorities to investigate we have been informed that there were links to three different locations.

– Only 1 of these contained any malicious files. The only way you can have been infected is if you opened the email, clicked on the link, downloaded the zip file and installed the fake program.


- The police inform us that the majority of the big anti-virus software providers have now updated their products to enable them to tackle this new Trojan.


- The authorities in the countries where the spam emails originated are also conducting investigations.

Please let the webmaster know any useful information about this via email.